You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/event-grid/event-domains.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -27,7 +27,7 @@ Event domains make available to you the same architecture used by Azure services
27
27
28
28
### Example use case
29
29
30
-
Event domains are most easily explained using an example. Let’s say you run Contoso Construction Machinery, where you manufacture tractors, digging equipment, and other heavy machinery. As a part of running the business, you push real-time information to customers about equipment maintenance, systems health, and contract updates. All of this information goes to various endpoints including your app, customer endpoints, and other infrastructure that customers have set up.
30
+
Event domains are most easily explained using an example. Let's say you run Contoso Construction Machinery, where you manufacture tractors, digging equipment, and other heavy machinery. As a part of running the business, you push real-time information to customers about equipment maintenance, systems health, and contract updates. All of this information goes to various endpoints including your app, customer endpoints, and other infrastructure that customers have set up.
31
31
32
32
Event domains allow you to model Contoso Construction Machinery as a single eventing entity. Each of your customers is represented as a topic within the domain. Authentication and authorization are handled using Azure Active Directory. Each of your customers can subscribe to their topic and get their events delivered to them. Managed access through the event domain ensures they can only access their topic.
33
33
@@ -39,13 +39,13 @@ It also gives you a single endpoint, which you can publish all of your customer
39
39
40
40
With a domain, you get fine grain authorization and authentication control over each topic via Azure's role-based access control (RBAC). You can use these roles to restrict each tenant in your application to only the topics you wish to grant them access to.
41
41
42
-
RBAC in event domains works the same way [managed access control](security-authentication.md#management-access-control) works in the rest of Event Grid and Azure. Use RBAC to create and enforce custom role definitions in event domains.
42
+
RBAC in event domains works the same way [managed access control](security-authorization.md) works in the rest of Event Grid and Azure. Use RBAC to create and enforce custom role definitions in event domains.
43
43
44
44
### Built in roles
45
45
46
46
Event Grid has two built-in role definitions to make RBAC easier for working with event domains. These roles are **EventGrid EventSubscription Contributor (Preview)** and **EventGrid EventSubscription Reader (Preview)**. You assign these roles to users who need to subscribe to topics in your event domain. You scope the role assignment to only the topic that users need to subscribe to.
47
47
48
-
For information about these roles, see [Built-in roles for Event Grid](security-authentication.md#built-in-roles).
48
+
For information about these roles, see [Built-in roles for Event Grid](security-authorization.md#built-in-roles).
Copy file name to clipboardExpand all lines: articles/event-grid/security-authentication.md
+8-171Lines changed: 8 additions & 171 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,16 +1,16 @@
1
1
---
2
2
title: Azure Event Grid security and authentication
3
-
description: Describes Azure Event Grid and its concepts.
3
+
description: This article describes different ways of authenticating access to your Event Grid resources (WebHook, subscriptions, custom topics)
4
4
services: event-grid
5
5
author: banisadr
6
6
manager: timlt
7
7
8
8
ms.service: event-grid
9
9
ms.topic: conceptual
10
-
ms.date: 05/22/2019
10
+
ms.date: 03/06/2020
11
11
ms.author: babanisa
12
12
---
13
-
# Event Grid security and authentication
13
+
# Authenticating access to Event Grid resources
14
14
15
15
Azure Event Grid has three types of authentication:
16
16
@@ -38,7 +38,7 @@ If you're using any other type of endpoint, such as an HTTP trigger based Azure
38
38
39
39
The provided URL is valid for 5 minutes. During that time, the provisioning state of the event subscription is `AwaitingManualAction`. If you don't complete the manual validation within 5 minutes, the provisioning state is set to `Failed`. You'll have to create the event subscription again before starting the manual validation.
40
40
41
-
This authentication mechanism also requires the webhook endpoint to return an HTTP status code of 200 so that it knows that the POST for the validation event was accepted before it can be put in the manual validation mode. In other words, if the endpoint returns 200 but doesn’t return back a validation response programmatically, the mode is transitioned to the manual validation mode. If there is a GET on the validation URL within 5 minutes, the validation handshake is considered to be successful.
41
+
This authentication mechanism also requires the webhook endpoint to return an HTTP status code of 200 so that it knows that the POST for the validation event was accepted before it can be put in the manual validation mode. In other words, if the endpoint returns 200 but doesn't return back a validation response programmatically, the mode is transitioned to the manual validation mode. If there's a GET on the validation URL within 5 minutes, the validation handshake is considered to be successful.
42
42
43
43
> [!NOTE]
44
44
> Using self-signed certificates for validation isn't supported. Use a signed certificate from a certificate authority (CA) instead.
@@ -80,7 +80,7 @@ To prove endpoint ownership, echo back the validation code in the validationResp
80
80
}
81
81
```
82
82
83
-
You must return an HTTP 200 OK response status code. HTTP 202 Accepted is not recognized as a valid Event Grid subscription validation response. The http request must complete within 30 seconds. If the operation doesn’t finish within 30 seconds then the operation will be canceled and it may be re-attempted after 5 seconds. If all the attempts fail then it will be treated as validation handshake error.
83
+
You must return an HTTP 200 OK response status code. HTTP 202 Accepted is not recognized as a valid Event Grid subscription validation response. The http request must complete within 30 seconds. If the operation doesn't finish within 30 seconds, then the operation will be canceled and it may be reattempted after 5 seconds. If all the attempts fail, then it will be treated as validation handshake error.
84
84
85
85
Or, you can manually validate the subscription by sending a GET request to the validation URL. The event subscription stays in a pending state until validated. The validation Url uses port 553. If your firewall rules block port 553 then rules may need to be updated for successful manual handshake.
86
86
@@ -99,7 +99,7 @@ During event subscription creation, if you're seeing an error message such as "T
99
99
100
100
#### Azure AD
101
101
102
-
You can secure your webhook endpoint by using Azure Active Directory to authenticate and authorize Event Grid to publish events to your endpoints. You will need to create an Azure Active Directory Application, create a role and service principle in your application authorizing Event Grid, and configure the event subscription to use the Azure AD Application. [Learn how to configure AAD with Event Grid](secure-webhook-delivery.md).
102
+
You can secure your webhook endpoint by using Azure Active Directory to authenticate and authorize Event Grid to publish events to your endpoints. You'll need to create an Azure Active Directory Application, create a role and service principle in your application authorizing Event Grid, and configure the event subscription to use the Azure AD Application. [Learn how to configure AAD with Event Grid](secure-webhook-delivery.md).
103
103
104
104
#### Query parameters
105
105
You can secure your webhook endpoint by adding query parameters to the webhook URL when creating an Event Subscription. Set one of these query parameters to be a secret such as an [access token](https://en.wikipedia.org/wiki/Access_token). The webhook can use the secret to recognize the event is coming from Event Grid with valid permissions. Event Grid will include these query parameters in every event delivery to the webhook.
Azure Event Grid allows you to control the level of access given to different users to do various management operations such as list event subscriptions, create new ones, and generate keys. Event Grid uses Azure's role-based access control (RBAC).
The last three operations return potentially secret information, which gets filtered out of normal read operations. It's recommended that you restrict access to these operations.
204
-
205
-
### Built-in roles
206
-
207
-
Event Grid provides two built-in roles for managing event subscriptions. They are important when implementing [event domains](event-domains.md) because they give users the permissions they need to subscribe to topics in your event domain. These roles are focused on event subscriptions and don't grant access for actions such as creating topics.
208
-
209
-
You can [assign these roles to a user or group](../role-based-access-control/quickstart-assign-role-user-portal.md).
If you need to specify permissions that are different than the built-in roles, you can create custom roles.
282
-
283
-
The following are sample Event Grid role definitions that allow users to take different actions. These custom roles are different from the built-in roles because they grant broader access than just event subscriptions.
284
-
285
-
**EventGridReadOnlyRole.json**: Only allow read-only operations.
286
-
287
-
```json
288
-
{
289
-
"Name": "Event grid read only role",
290
-
"Id": "7C0B6B59-A278-4B62-BA19-411B70753856",
291
-
"IsCustom": true,
292
-
"Description": "Event grid read only role",
293
-
"Actions": [
294
-
"Microsoft.EventGrid/*/read"
295
-
],
296
-
"NotActions": [
297
-
],
298
-
"AssignableScopes": [
299
-
"/subscriptions/<Subscription Id>"
300
-
]
301
-
}
302
-
```
303
-
304
-
**EventGridNoDeleteListKeysRole.json**: Allow restricted post actions but disallow delete actions.
305
-
306
-
```json
307
-
{
308
-
"Name": "Event grid No Delete Listkeys role",
309
-
"Id": "B9170838-5F9D-4103-A1DE-60496F7C9174",
310
-
"IsCustom": true,
311
-
"Description": "Event grid No Delete Listkeys role",
You can create custom roles with [PowerShell](../role-based-access-control/custom-roles-powershell.md), [Azure CLI](../role-based-access-control/custom-roles-cli.md), and [REST](../role-based-access-control/custom-roles-rest.md).
350
-
351
-
## Encryption at rest
352
-
353
-
All events or data written to disk by the Event Grid service is encrypted by a Microsoft-managed key ensuring that it is encrypted at rest. Additionally, the maximum period of time that events or data is retained is 24 hours in adherence with the [Event Grid retry policy](delivery-and-retry.md). Event Grid will automatically delete all events or data after 24 hours, or the event time-to-live, whichever is less.
190
+
All events or data written to disk by the Event Grid service is encrypted by a Microsoft-managed key ensuring that it's encrypted at rest. Additionally, the maximum period of time that events or data retained is 24 hours in adherence with the [Event Grid retry policy](delivery-and-retry.md). Event Grid will automatically delete all events or data after 24 hours, or the event time-to-live, whichever is less.
0 commit comments